Bump registries to v0.6.0 and gate client with safehttp

go.mod

@@ -5,7 +5,7 @@ go 1.25.6
 require (
 	github.com/ecosyste-ms/ecosystems-go v0.1.1
 	github.com/git-pkgs/purl v0.1.12
-	github.com/git-pkgs/registries v0.5.1
+	github.com/git-pkgs/registries v0.6.0
 	github.com/git-pkgs/vers v0.2.5
 )
 

go.sum

@@ -13,8 +13,8 @@ github.com/git-pkgs/pom v0.1.4 h1:C6st+XSbF75eKuwfdkDZZtYHoTcaWRIEQYar5VtszUo=
 github.com/git-pkgs/pom v0.1.4/go.mod h1:ufdMBe1lKzqOeP9IUb9NPZ458xKV8E8NvuyBMxOfwIk=
 github.com/git-pkgs/purl v0.1.12 h1:qCskrEU1LWQhCkIVZd992W5++Bsxazvx2Cx1/65qCvU=
 github.com/git-pkgs/purl v0.1.12/go.mod h1:ofp4mHsR0cUeVONQaf33n6Wxg2QTEvtUdRfCedI8ouA=
-github.com/git-pkgs/registries v0.5.1 h1:UPE42CyZAsOfqO3N5bDelu28wS4Ifx/aOj0XZS4qYeI=
-github.com/git-pkgs/registries v0.5.1/go.mod h1:BY0YW+V0WDGBMuDR2aSMR3NzOPFK4K+F3j6+ch+cq3M=
+github.com/git-pkgs/registries v0.6.0 h1:ttQC8via9XAoLk9vqysf0K7uWl1bAyHPBWRBavRpAqs=
+github.com/git-pkgs/registries v0.6.0/go.mod h1:BY0YW+V0WDGBMuDR2aSMR3NzOPFK4K+F3j6+ch+cq3M=
 github.com/git-pkgs/spdx v0.1.3 h1:YQou23mLfzbW//6JlHUuc5x1P5VNIIDSku5gvauf86I=
 github.com/git-pkgs/spdx v0.1.3/go.mod h1:4HGGWyC8tg4DjOhrtBTYl4Lu+5i2BFuauGX8zcVcYPg=
 github.com/git-pkgs/vers v0.2.5 h1:tDtUMik9Iw1lyPHdT5V6LXjLo9LsJc0xOawURz7ibQU=

registries.go

@@ -7,6 +7,7 @@ import (
 	"github.com/git-pkgs/purl"
 	"github.com/git-pkgs/registries"
 	_ "github.com/git-pkgs/registries/all"
+	"github.com/git-pkgs/registries/client"
 	"github.com/git-pkgs/vers"
 )
 
@@ -21,7 +22,10 @@ func NewRegistriesClient() *RegistriesClient {
 }
 
 func newRegistriesClient(userAgent string) *RegistriesClient {
-	c := registries.DefaultClient()
+	// PURLs may carry an attacker-supplied repository_url qualifier that
+	// NewFromPURL/BulkFetchPackages will fetch from; gate the client's
+	// transport so loopback/RFC1918/link-local targets are refused.
+	c := registries.NewClient(client.WithSafeHTTP())
 	c.UserAgent = userAgent
 	return &RegistriesClient{client: c}
 }

registries_test.go

@@ -0,0 +1,30 @@
+package enrichment
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"sync/atomic"
+	"testing"
+)
+
+func TestRegistriesClientBlocksLoopbackRepositoryURL(t *testing.T) {
+	var hits int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		atomic.AddInt32(&hits, 1)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	c := NewRegistriesClient()
+	purl := "pkg:npm/lodash?repository_url=" + url.QueryEscape(srv.URL)
+
+	_, err := c.GetVersions(context.Background(), purl)
+	if err == nil {
+		t.Fatalf("expected safehttp to refuse loopback %s, got nil error", srv.URL)
+	}
+	if n := atomic.LoadInt32(&hits); n != 0 {
+		t.Fatalf("loopback server received %d requests; safehttp gate did not block dial", n)
+	}
+}